11 ms·

German developer guilty of 'hacking' for exposing hardcoded credentials in app

325 points by zoobab 3y ago

blurbleblurble 3y ago
This is outrageous.
- Log_out_ 3y ago
  No it's Germany. That law is a seal of quality on any germ software. So bad security wise, they need obscurity by lawzyness as main protection.
  - busterarm 3y ago
    Precious Germany. Swiss cheese security enshrined and protected by law but will blow an absolute fucking gasket if your open source software is even remotely applicable to national defense.
    - dzhiurgis 3y ago
      Explain the latter part?
      - busterarm 3y ago
        See NixCon 2023, but also in general universities and student organizations in the country mandating that you pretend the defense industry doesn't exist if you want to have a presence there. Just about anything German-hosted in the Fediverse is absolutely allergic to the industry and users will lose their fucking minds and hound you to the ends of the earth and send you death threats if you forget this fact. Basically shitty ideologues who put purity ahead of the technology dominate every level of the discourse there. It wastes everyones' time and distracts from things that actually matter. In fairness, America isn't far behind.
        _dain_ 3y ago
        > NixCon 2023 what happened there?
        alphager 3y ago
        https://discourse.nixos.org/t/nixcon-2023-sponsorship-situation-from-the-nixos-foundation/33583 https://discourse.nixos.org/t/nixcon-2023-sponsorship-situat... TL/DR: they accepted sponsorship by Anduril, a weapons manufacturer and publicized that fact 3 days before the conference. The German scene is quite pacifistic and threw a fit.
        busterarm 3y ago
        While "threw a fit" is accurate, it really does downplay the level of hostility that was expressed in response to the situation. It was unbecoming of any group that wishes to call itself a community and it certainly has chilled participation from reasonable people.
  - dylan604 3y ago
    So what happens when the vuln is accessed from someone not under German legal jurisdiction?
    - exe34 3y ago
      Vee schend zem a sthrungly vorded letter!
  - CalRobert 3y ago
    If you needed security you should've used a fax!
coldblues 3y ago
Should have sold the information on a forum like any reasonable person would.
- judge2020 3y ago
  Sounds like they're a customer of the vendor, so they'd be pwning themselves if they did so.
  - rokkitmensch 3y ago
    Employee of the customer of the vendor!
  - jeroenhd 3y ago
    The password was hardcoded into the executable you can download from their website. It wasn't unique. The only trace would've been the database software the guy used showing up in the mysql connection logs, but if he used a VPN the trail would probably die there as far as Modern Solution is concerned.
- rokkitmensch 3y ago
  The laws as structured and enforced will teach people to do this in time.
fkkffdddd 3y ago
Paragraph 202a of the criminal code: https://www.gesetze-im-internet.de/stgb/__202a.html https://www.gesetze-im-internet.de/stgb/__202a.html Roughly: „Gaining access to data that is protected with special methods against unauthorised access, either for personal use or for others“ So apparently, hardcoded passwords baked into the client do qualify for that.
- sgift 3y ago
  Yeah. It's well known as a really shitty law, which should never have been passed. But here we are. Maybe until 2050 they fix it or so.
  - aleph_minus_one 3y ago
    § 202c is even worse: > https://www.gesetze-im-internet.de/stgb/__202c.html https://www.gesetze-im-internet.de/stgb/__202c.html English translation based on the DeepL translation: "§ 202c Preparing the spying and interception of data (1) Any person who prepares an offense under § 202a or § 202b by 1. passwords or other security codes that enable access to data (§ 202a (2)), or 2. Computer programs whose purpose is the commission of such an offense, or by procuring, selling, transferring, distributing or otherwise making available to himself or another person, shall be liable to a custodial sentence not exceeding two years or to a monetary penalty. (2) § 149 (2) and (3) shall apply accordingly."
  - TillE 3y ago
    The silver lining is that the punishment for crimes in Germany is generally extremely lenient. The article mentions a 3000 Euro fine plus legal fees.
j-bos 3y ago
Isn't this the opposite of good samaritan laws? If you see something, say, nothing, do nothing. I wonder, if it's illegal to find these problems, would it be legal to notice there might be a problem, stop, and short the company stock?
- IshKebab 3y ago
  > would it be legal to notice there might be a problem, stop, and short the company stock? Yes. As long as you don't use inside information this would be perfectly legal. It's pretty much what companies like Hindenburg Research do. The problem you would find if you actually tried to do this is that investors pretty much don't care about security issues, so the stock price wouldn't go down after you revealed the flaw. That's even if they're publicly traded which doesn't appear to be the case here. I think it's these guys but I don't speak German so don't quote me: https://www.modernsolution.net/ https://www.modernsolution.net/
- hipadev23 3y ago
  Issue is those flaws can go unnoticed for years, so you may need to give them a nudge for your short to be successful. There’s also the fact that at least for US companies massive data leaks/breaches often have no negative financial impact on the company.
- ajsnigrutin 3y ago
  Tor + twitter (if you can actually register there with tor): "Hey, I just happened to find out that there is a password here in this app, at offset X, here's the screenshot from the hexdump with the visible password... I'm not allowed to check what that password is, even though there is also a username and a host next to it, and clear indication that it's an sql connection, but i'm not testing this, but i'm warning you, the general public, that this here exist, please don't try connecting to this IP using this username and password, thank you!"
mywittyname 3y ago
We, as an industry, need to create an institution that lobbies for fair laws on the handling of computer crimes as well as creates public awareness campaigns that help people better understand cyber crimes. I'd like to see "Good Samaritan" laws for cyber crime. This kind of thing is what enables cyber crime. I personally find lots of bugs with APIs, since my job involves dealing with so many of them. I basically don't report them for fear of prosecution. There's already a fear in the back of my mind when I'm trying to work around such bugs that someone will come after me, but at least I have some plausible deniability to say, "I just wrote shitty software." Whereas, if I report a bug, that means I knew about it and admit to "probing" it to elicit more information. I literally spent 4 hours this morning working around a vendor API bug.
- costco 3y ago
  That's what the EFF does.
  - soraminazuki 3y ago
    Would that help the German developer though?
  - yieldcrv 3y ago
    I don’t get how the tech sector as a whole is so inept at this after half a century now. EFF plays defense, when it should be playing offense more effectively Organizations like it need to be donating to campaigns Play the game until the lobbying laws change All of our people should have been pardoned because the President was in our pockets. Aaron Schwartz would have had nothing to worry about, maybe that gets someone attention here
- deleted 3y ago
  [deleted]
_l219 3y ago
After moving to the UK, it has been my policy to pretend to see nothing. During my first week in university, I found a vulnerability in two of their servers allowing me to execute arbitrary code/commands + escalate to root due to a very outdated kernel. I reported this to a lecturer and was immediately told that what I did was illegal and not to poke at any of their services. Last I checked, it still hasn’t been fixed.
- jonnycomputer 3y ago
  The ostrich approach to tech security.
  - ngneer 3y ago
    If it ain't broke don't fix it ;)
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
- spacecadet 3y ago
  Yes it is illegal, wont stop someone. Fools.
- tommiegannert 3y ago
  > I reported this to a lecturer I wonder if such reports would be taken more or less serious if it was made anonymously.
wackget 3y ago
Article/title is a bit confusing and perhaps borderline clickbait, so... If I understand correctly it seems like his crime was *using* the exposed database credentials to log in to the third-party database server. So he wasn't charged for simply "exposing" the credentials as the title says, but actually using them to poke around.
- bluefirebrand 3y ago
  It is basically impossible to know what a system is without accessing it and looking around. It is like being given a key card for security clearance in a building. You assume any door it opens is a room you're allowed to be in. If security finds you in a room you aren't supposed to be in, is that your fault? Or whoever gave you the card with the wrong clearance level? Also how about the situation where you open a door, look inside, immediately realize you're not supposed to be there and then report it to security? Should you be punished?
  - secondcoming 3y ago
    I don't see why an investigation into excessive logging requires running queries on a database.
    - lcnPylGDnU4H9OF 3y ago
      If they connect with a desktop application, said application might run some queries against `INFORMATION_SCHEMA` in order to display schemas, tables, and columns. If the investigation is open-ended enough ("we have no idea so just figure it out"), then it might seem reasonable to connect to the database to see what it's about. It's already hard to see the malice in their actions but it's harder still when I consider that they immediately alerted the company who made the error. Even more when I consider that the company fixed the error. This developer did the company a favor and they had charges filed against them over it.
      - formerly_proven 3y ago
mdgrech23 3y ago
So many "hacks" are the equivalent of some fool left the front door wide open. If you left your front door wide and were robbed the public would have 0 sympathy for you yet people scream at the Hackers when these companies cheap out and don't do shit to update/maintain/enforce basic best practices around security.
- babarock 3y ago
  It's not about "sympathy". It's about crime. If you left your front door wide and I robbed you, I'd have committed a crime. There's no "but the front door was open" defense.
  - wvenable 3y ago
    But nobody was robbed. This guy looked in the house and then immediately called you to tell your door is open. Instead of thanking him, you sue him for trespassing. Technically, he would be guilty of trespassing.
    - hooverd 3y ago
      Private residentce is a bad analogy. This is like being sued for trespassing because you stepped over a green-grey marble line on the grey-green marble floor of the open ground floor lobby of an office building where you work.
  - AndroTux 3y ago
    It’s like telling someone the pin to your safe and then suing them for them opening it. They didn’t even steal anything. They just opened the safe that you gave them the pin for.
- bdcravens 3y ago
  > If you left your front door wide and were robbed It would still be a crime. I would and should be chastised, but the person who robbed me should still receive a proper punishment.
happytoexplain 3y ago
I struggle with the use of the word "hacking". Sometimes we want it to mean a penetration that requires exceptional knowledge and effort. Sometimes we just want it to mean "fiddled with the internals". I once did a search in the free version of Feedly. They showed me the real search results, behind a "this is a paid feature" overlay. I submitted feedback saying they should either provide the feature or not provide it - and refrain from this in-between teasing. I mentioned that I deleted the overlay in the HTML to see the results, and they told me I had "hacked" the web app in their response. That usage, and this usage, are ridiculous, because they imply an unscrupulousness that isn't present. And yet applying the friendlier meaning of the word, as in "Hacker News", I think is reasonable in both cases.
- aleph_minus_one 3y ago
  > I struggle with the use of the word "hacking". Sometimes we want it to mean a penetration that requires exceptional knowledge and effort. Sometimes we just want it to mean "fiddled with the internals". "Hacking" means "getting (typically) technology to do things that they were not intended to do, sometimes in a playful way". The other meaning was purposefully disseminated by the mainstream media to spread fear and hate against the hacker scene, because their knowledge about programming, computers and technology was a thorn in the side of specific groups in power.
  - fluoridation 3y ago
    Okay, but that clearly cannot be the meaning being used here, since to prohibit "hacking" in this sense is not unlike a blanket prohibition on "play".
    - aleph_minus_one 3y ago
      Did you read the original link: https://infosec.exchange/@WPalant/111776937550399546 https://infosec.exchange/@WPalant/111776937550399546 "Current news: A court found a developer guilty of “hacking.” His crime: he was tasked with looking into a software that produced way too many log messages." Note that “hacking.” is in quotes, which should clear the opinion that the poster "Yellow Flag" considers it to be ironic that this action is called "hacking".
yieldcrv 3y ago
so he would have been fine if he didn't check the vendor database? or if he got written authorization to check the database?
HL33tibCe7 3y ago
No, he was found guilty for using those credentials to connect to the database. I can’t speak for German law, but at least in the UK this would be an open-and-shut case, it’s a clear violation of the Computer Misuse Act. You can like that or not, but if you’re in the position to be doing research like this, you really ought to know the basics of the law.
- a_dabbler 3y ago
  Sounds to me like the database credentials were embedded in the application so presumably the application would log in to the vendors server as an intended action. Does this mean all the vendors users must be charged with hacking also?
  - HL33tibCe7 3y ago
    The clue’s in the name: “misuse”.
    - dzhiurgis 3y ago
      Is there evidence he misused the data or the server? Did he download all the data and sold to third parties, spammed the hell out of existing users or anything like that? How is verifying the credentials misuse?
      - HL33tibCe7 3y ago
        He didn’t just “verify the credentials”. He was in the database making queries, viewing private data.
        feanaro 3y ago
        "Viewing" private data for purposes of verification of the issue. How about you just don't ship passwords in the application like some negligent troglodyte?
        3y ago
vdaea 3y ago
After reading the text I predict this is completely sensationalised and that something worse happened.
- z500 3y ago
  According to the linked heise.de article the defendant assumed the credentials were for a database that only contained his client's data, and immediately disconnected as soon as he realized he was actually seeing data for all of the complainant's clients.
- pgeorgi 3y ago
  It's a lowest level court, they're known to have wildly absurd legal opinions at times. Having stupid laws on the book (like the one in question) doesn't help. The curious bit is that this law is from 2007, so apparently this is an angle that escaped all attorney and courts who applied this law in 16.5 years, or the defense could have shot down this line of reasoning by pointing out that this isn't what the law intended. (we don't have case law, but there are means of harmonizing outcomes once stuff ended up at higher level courts) My guess is that this won't hold up for long given the circumstances (trivially got the password, accidentally gained more access than expected, immediately disconnected upon notice)
  - cybrox 3y ago
    I've been following this for a long while now, as I frequent one of the forums that this person is also active on. Even if the sentence is overturned by a higher instance, the confiscation of all devices for months and the additional legal trouble have made pretty sure that this person will not make the same "mistake" again. The company's public statements during the whole affair were another story entirely. For these alone they'd deserve the next guy to just sell the credentials on a forum and have them blow up.
magicmicah85 3y ago
It's a very fine area. Once he had the database credentials, that's all he needed to tell the company to fix their code. Connecting to the database is what did him in. We need white hats that want to find vulnerabilities for good, but when you exploit a target and they aren't aware until after the fact, that's still a crime. I don't know what the safe way of doing this is other than only doing white hat hacking on systems you control. Any system outside of your control should not be exploited unless the company has an agreed upon contract that indemnifies you from any harm caused.
- fluoridation 3y ago
  Alternatively, reporting the vulnerability is what did him in. This seems to encourage an adversarial environment where no one will report any vulnerabilities they find for fear of repercussions. If their good faith efforts will be used against them, they may as well act in bad faith.
- raphman 3y ago
  The developer claims that he assumed that he assumed that the database credentials were specific to the customer he was helping debug the problem. Once he realized that he could see other data, he closed the connection and notified the company. I'd argue that a customer who accesses their own data on a vendor's database via a client has also the right to access it via a different client.
throwitaway1123 3y ago
Something similar happened in Missouri a few years ago when the state's web developers leaked thousands of social security numbers in the HTML of one of their websites. A reporter noticed the flaw, reported it to the state government, waited for them to fix it, and then finally publicized the security issue. The governor (Mike Parson) accused the reporter of "hacking" because he clicked the view source button in his browser.
- deleted 3y ago
  [deleted]
yukkuri 3y ago
Better to just pretend you never noticed it. Even telling them their password is visible is risking being the messager that gets shot. Using the password is right out.
daltont 3y ago
Sounds similar to a case where I am from: https://www.techdirt.com/2022/02/25/turns-out-it-was-actually-missouri-governors-office-who-was-responsible-security-vulnerability-exposing-teacher-data/ https://www.techdirt.com/2022/02/25/turns-out-it-was-actuall... The "hacking" was decrypting social security numbers from BASE64.
- throwitaway1123 3y ago
  Yeah, this is exactly the case that the headline reminded me of (I got instantly downvoted for commenting about this for some reason). If they had actually encrypted the data it would have been fine, but BASE64 encoding is not encryption. It's trivially easy to decode base64: https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem https://developer.mozilla.org/en-US/docs/Glossary/Base64#the...
- RajT88 3y ago
  Funny message in the encoded Base64 on that article, which reminds me of a musing I had a while back. Imagine the number of lazy programmers who paste stuff into an online Base64 decoder. Imagine all the stuff that is in those payloads! Running a site like base64decode.org would be a fantastic honeypot.
  - j-bos 3y ago
    That's why many large firms block online code assist tools.
formerly_proven 3y ago
This case has been going on for a few years. Last summer the court declined the prosecutor's case (in this system, the prosecutor files their case with the court, and the court does a quick scan and will dismiss the case before scheduling the trial if it's obviously unsound - happens fairly rarely). Prosecutors got this overturned by a higher court, which means this trial happened at the same lower court, but with a different judge than the one who initially dismissed the case. > According to a decision by the Jülich District Court on May 10, 2023, the criminal proceedings against the security researcher have been dismissed. The court assumes that no criminal offense has been committed because the data accessed by the security researcher was not sufficiently protected. "Only data that is specially protected against unauthorized access is subject to the scope of protection of the criminal offence. This presupposes that measures have been taken that are objectively suitable [...] to prevent access to the data," the court's decision states. "The court does not agree with the opinion of the public prosecutor's office that password protection as such is sufficient. A password does not always provide effective data protection, for example if it is too simple or is used in a standardized way for certain applications. In such cases, the provision of access to data does not constitute an offense." > Through its own investigations of the Modern Solution software, heise online was able to confirm that it did indeed contain a built-in default password. This meant that anyone who had examined the software, which was freely downloadable from the company's website, would have had access to the data on the Modern Solution servers.
Alifatisk 3y ago
Can we flag posts for clickbait headline?
orenlindsey 3y ago
This is like giving someone a book you wrote to proofread, with your password unintentionally in the text. They use it to login and then tell you about it. Sure, they shouldn't have logged in, but it doesn't feel like it deserves criminal charges.
- PurpleRamen 3y ago
  Just because you can, doesn't mean you should... And it's not a criminal charge, the penalty is paying 3000 Euro and the costs of the lawsuit.
hypeatei 3y ago
Seems like those laws to need to be re-written. Intent matters and it doesn't seem like this "hacker" was trying to do any harm. Company got caught with their pants down and want to punish this person for exposing that.
- quickthrower2 3y ago
  Yeah it is a chilling effect that will make German systems less secure, and other countries who are immune from German prosecution are going to exploit that. This story alone makes me refuse to work in Germany as a developer let alone in security.
  - WesolyKubeczek 3y ago
    Hackers somewhere in Novosibirsk who look for ways to disrupt or exfiltrate data from some of the Germany's bigger IT systems, are likely very gleeful now. Look ma, they just leave their passwords in cleartext, and people are scared shitless to report it, lest they be sued! It's a pure gold mine!
- EasyMark 3y ago
  I agree, this conviction is really about challenging corporatism and making them look bad. They really want "the peasants" to know their place and not peep through the nobles' windows. The state will almost always side with those with the most money, unless lawyers somehow shine the light of public opinion on it, then they might have a chance. This is why you do stuff anonymously.
ttyyzz 3y ago
Greetings from Germany, I would not be surprised in the slightest if German legislation considered pressing F12 in your browser looking at the HTML was considered "hacking".
- deleted 3y ago
  [deleted]
- pavel_lishin 3y ago
  Where do you think Germany is, in Missouri? https://www.theverge.com/2021/12/31/22861188/missouri-governor-mike-parson-hack-website-source-code https://www.theverge.com/2021/12/31/22861188/missouri-govern...
niemandhier 3y ago
If you ever wonder why Germany is trapped in a predigital state since the late 2000s: Things like this are the reason. If met people from all over the word, some of the coolest hackers and devs were from Germany, but: The perpetual effort of the German government to make all things „safe „ and „stable“ hinders the evolution of the country into something greater than a nation of car manufacturers.
- aleph_minus_one 3y ago
  > If you ever wonder why Germany is trapped in a predigital state since the late 2000s I think the term "(pre)digital" does not fit: for example CDs and punchcards are clearly digital.
- deleted 3y ago
  [deleted]
- pmarreck 3y ago
  Here's a good article on the problem. Seriously, given how excellent most other qualities of life are in Germany, and how smart/educated Germans are, the Internet situation is jarringly bad (for anyone who visits or emigrates, and isn't used to it). I think there's even a bit of pride about it, I hate to say. Germans are pretty proud of their outdoor activities and general physical health, and "device obsession" works directly against that... and is still not as much of a thing there as in the US for example. You could make an argument for it... https://www.settle-in-berlin.com/why-is-internet-so-bad-in-germany/ https://www.settle-in-berlin.com/why-is-internet-so-bad-in-g... tl;dr Blame Helmut Kohl. Helmut was clearly the type of guy who would have printed out his emails (if he even had to email, if perhaps only by necessity) until the day he died.
  - aleph_minus_one 3y ago
    > Here's a good article on the problem. Seriously, given how excellent most other qualities of life are in Germany, and how smart/educated Germans are, the Internet situation is jarringly bad (for anyone who visits or emigrates, and isn't used to it). > I think there's even a bit of pride about it, I hate to say. Germans are pretty proud of their outdoor activities and general physical health, and "device obsession" works directly against that... and is still not as much of a thing there as in the US for example. You could make an argument for it... Honestly, I am not sure what kind of "device obsession" in other countries vs Germany you are talking about. My impression, as a German, is that many German people value other qualities of technological products than what is valued in other countries. For example, many German customers value long-lasting, robust products instead of the latest fad that will be out of fashion in a few years. For example, many Germans who are able to afford them would love household appliances built by Miele. Also, because of the German history (two dicatorships on German soil of which one ended little more than 30 years ago), many Germans are much more suspicious of "spying devices" (e.g. internet-enabled home appliances (IoT)) and things that might track you (this is also a reason why many Germans strongly prefer paying cash). But it is nevertheless my impression that many Germans nevertheless do have quite some love for devices that do fit their values; it's just that the taste is quite different from the taste in other countries.
wouldbecouldbe 3y ago
Had a food startup in the Netherlands. Worked with PostNL, the main and previous governmental organisation for sending mail. Weekly we would upload our orders in their system; and could see our history. Then one day we could suddenly access all other clients history and export their users data. Many of them direct competitors, and their mailing lists would have been quite valuable to us. My partner exported all Marley Spoon's (a bigger funded competitor) data in excel and a few others. When he told me I told him to delete it ASAP, even though it's fun you don't create a liability. But we could have used it to grow 10-30% in a few weeks. They never reported it, which they were legally obliged to do under EU law. All to say, if you get the keys to the castle, maybe don't use them. Or maybe you do. We should, and could have used it, in price negotiations since they almost doubled the prices to us for the next few months and didn't have any mercy. Let alone misplacing 3-8% of our orders and not refunding. But instead we moved to few other delivery services (with all their own flaws)
- jeroenhd 3y ago
  You can anonymously tip the Autoriteit Persoonsgegevens and let them look into the issue if you're afraid of repercussions. Any screenshot containing evidence of PII being leaked will certainly help, and I doubt PostNL will have fixed their terrible terrible systems. Under Dutch law your colleague would've committed a crime by downloading the data he knew he shouldn't be allowed to access, beyond what was necessary to conclude that there was a leak. "Using" this indo during negotiations would've been blackmail, which is very much a thing you wouldn't want to do, especially with a company that big and without real competition; they'd go to the police, and you'd be screwed.
  - wouldbecouldbe 3y ago
    You can subtly mention things to alter the dynamics of a conversation without it being blackmail ;). Or forcefully making demands and wanting proof that our data is safe. To report it now, it's so many years back by now, not worth the trouble and proof is gone. But they were so disrespectful to us regarding not wanting to refund a lot of lost orders while at the same time doubling prices, that I almost reported them out of spite.
gumballindie 3y ago
> So he immediately informed the vendor – and while they fixed this vulnerability they also pressed charges. Germany has an obsession with accusing people of crimes. Perhaps a projection?
- cybrox 3y ago
  Ah yes, the homogeneous entity of germany born in 1939... To the bottom you go.
  - gumballindie 3y ago
    I am confused by your comment.
petre 3y ago
Ah Germany, where everything is precisely regulated, even the use of kitchen knives, which are of course unlawful to use outside of the kitchen. Nur in der Küchen schneiden mit dem Küchenmesser!
- hnbad 3y ago
  I'm not sure what you're talking about. If you carry around a kitchen knife in public for no good reason, it's not a kitchen knife, it's a weapon. Likewise if you carry around a baseball bat and didn't just buy it or are on your way to a baseball game or to gift it to someone, that's a weapon too. Carrying weapons in public without a permit is illegal. If you're merely transporting the kitchen knife to a party to help your friend prepare snacks, that's clearly not a weapon even though you're in public and carrying a knife. I've done medieval reenactment in Germany and used public transit in full kit with spears and swords and everything. I've been stopped by police a few times to check that they are indeed dull and blunt and therefore can legitimately be considered sporting or theatrical equipment but that shouldn't be surprising as it effectively looked like I was "open carrying" medieval weaponry for unknown reasons. Heck, the only times I was stopped were around the time someone robbed a gas station with a sharpened katana so I can't even fault them for being careful.
  - petre 3y ago
    Robbing a gas station with a sharpened katana makes me yawn. The US ha solved this with shotguns. In Europe I'd totally use the fire extingusher. Actually I'm quite fond of Germany as boring as it is.
Zamicol 3y ago
The law shouldn't be involved in this. Fix your systems. Tax payers should not be forced to defend poorly designed systems.
- aleph_minus_one 3y ago
  > The law shouldn't be involved in this. There were huge public rallys when the § 202c StGB (https://news.ycombinator.com/item?id=39047767 https://news.ycombinator.com/item?id=39047767) was to become introduced. In Germany, we learnt that resistance and rallys against the politics is typically futile. Thus, in the recent years in some circles in Germany it has become actually fashionable to speak "Politiker" (politician) in a tone as if you were speaking of a mass rapist or child abuser (and covertly do this word replacement in your head). Believe me: in some circles in Germany, the fury against the politicians of basically every party is insane. :-(
WesolyKubeczek 3y ago
Next time: never report anything. Sell it on some black market, then forget everything about it. Alternatively, get a sockpuppet account, publicize the information anonymously somewhere, then pretend you accidentally stumbled upon it and sue the vendor for gross negligence with your data. Go on the offence. Germany is so anal on privacy laws that I suspect the whole case has been hinging on the company making the first move. Keep sucking those sweet damages. I'm surprised there's not a whole fucking industry around this behavior, which is way too common to go unpunished. Don't be a boy scout. This seems to be frowned upon these days.
posterboy 3y ago
Title could be read as exposing by means of an app dedicated to exposing said credentials. Hackernews suggests something else, but hasn't really outlined the expose-action. The text of the decision should be paramount.
woopwoop24 3y ago
meh, low level court decision, this will not stand in the higher court.
jansommer 3y ago
I think a lot of issues are never reported because of stuff like this. We hear about white hat hackers getting sued all the time. And in the end it'll hurt us all because crooks don't care, and will use these found-but-undisclosed security holes to their advantage. Then, when they threaten the company to either pay or get a public dump of their wide-open database, management refuses and gets a slap on their wrist by the government once it's released - and customers receive a "sorry, we got hacked"-mail between a bunch of highly personalized phishing mails.
BonoboIO 3y ago
What a sad case and i think nobody should do business with this corporation ever again. Next time: use a vpn, get yourself a anonymous email address and report it to your goverment dataprivacy office. Make it hurt. Make it hurt bad.
sva_ 3y ago
Ah, the infamous "hackertoolparagraf". The hacking tool in question? According to [0] it was phpMyAdmin. 0. https://nitter.net/der_sofc/status/1747644600469127386 https://nitter.net/der_sofc/status/1747644600469127386 edit: Apparently der_sofc is the person who got sued.
riedel 3y ago
The German article link gives a few nuances more: first the ruling is not yet binding and has chances of going into revision. Secondly the fine seems partially due to a public disclosure to press while offering competing services.
- evilDagmar 3y ago
  Frankly I think they should just take their lumps and shut up. Other bits of the article mention that apparently Heise Online was able to freely download a copy of the binaries (passwords included!) from Modern Solution's website in 2021 and I'm going to guess based on that that other people probably did know about this who were reasonably moral about it, and the company was likely ignoring the issue... ...until someone offering competing services noticed it and said something, at which point they panicked and decided it was still cheaper to shoot the messenger than to hire a couple of highly-caffienated teenagers to fix their trash architecture.
scrps 3y ago
Good marketing pitch for disclosing to the highest bidder rather than responsibly to industry, gonna go to jail you might as well get top dollar for your trouble. Oh no we did a terrible job and hardcoded credentials, someone found and tried a password and then reported it without stealing or destroying anything but our egos... the horror. Let's run to the cops and potentially ruin a life.
dudalev 3y ago
Isn’t it the vendor that should be immediately countersued by the customer for the lack of any actual protection?
jpgvm 3y ago
No good deed goes unpunished.
bsdice 3y ago
This is actually a big problem for Germany, because the cited StGB 202 ff. penal code paragraphs have made security research in any private sector shape or form impossible, or at least highly unattractive. Now a gap of almost 20 years has opened, where basically no young engineers have been interested in the field, let alone trained. The biggest companies with the deepest pockets have been mopping up anyone they could find. Top talent went abroad. And so the majority of German businesses which are SMB get hacked more every day. Nobody audits anything. Unfortunately, anything networked is a security risk these days. I caution that it is highly naive to bet on this getting thrown out at higher court levels. Defendant is looking at YEARS of wasted brain cycles, trying to go from AG to LG to OLG to BGH. My guess is a 100k EUR of fees also wasted. And for what. Because a company couldn't properly secure their data, you told them that, and as a "thank you", they sued you in court? My advice: If there is no clear bug bounty program, or it is not your own company, or you weren't tasked in writing and paid by the very company to find any holes, don't make it your problem. Suppress any good samaritan helper complex you might have. Wipe all files and talk to nobody. Especially not in your place of employment. Once a lawsuit is involved, anyone questioned will say "Oh, Mike from DevOps figured that one out from the hexdump". You will regret it. Some of the older German infosec dogs are aggravated by this so much, that they refuse to help any governmental organization if there is an incident. Lernen durch Schmerz.
rurban 3y ago
For more context: His crime was to be a business competitor of this shady company Modern Solution, which shipped the password of all its customers. He was not an independent security researcher.
evilDagmar 3y ago
Sadly this is why one must notify vendors anonymously, and tell them up front they have 30/60/90 days to fix it before the information will be made public. This vendor was abysmally irresponsible by storing static credentials in the application with apparently full read access to the databases. Stored procedures exist for a reason and they're not even remotely new. If a "bad guy" had dug this out first, things would have been much, much worse for everyone involved, including the vendor. Trying to shoot the messenger makes me wish they'd mentioned which vendor so that their customers could be encouraged to go with someone who takes security even a little bit seriously.
dorameleg 3y ago
I don't understand how this news started spreading so much now. This actually hpapened in 2021. Everybody mentions the original source, Heise, but nobody checked it. Their article was published in 2021. https://www.heise.de/news/Datenleck-Anzeige-gegen-IT-Experte-kam-von-Modern-Solution-6254839.html https://www.heise.de/news/Datenleck-Anzeige-gegen-IT-Experte...

325 points by zoobab 3y ago

blurbleblurble 3y ago

This is outrageous.

Log_out_ 3y ago
No it's Germany. That law is a seal of quality on any germ software. So bad security wise, they need obscurity by lawzyness as main protection.
- busterarm 3y ago
  Precious Germany. Swiss cheese security enshrined and protected by law but will blow an absolute fucking gasket if your open source software is even remotely applicable to national defense.
  - dzhiurgis 3y ago
    Explain the latter part?
    - busterarm 3y ago
      See NixCon 2023, but also in general universities and student organizations in the country mandating that you pretend the defense industry doesn't exist if you want to have a presence there. Just about anything German-hosted in the Fediverse is absolutely allergic to the industry and users will lose their fucking minds and hound you to the ends of the earth and send you death threats if you forget this fact. Basically shitty ideologues who put purity ahead of the technology dominate every level of the discourse there. It wastes everyones' time and distracts from things that actually matter. In fairness, America isn't far behind.
      - _dain_ 3y ago
        > NixCon 2023 what happened there?
        alphager 3y ago
        https://discourse.nixos.org/t/nixcon-2023-sponsorship-situation-from-the-nixos-foundation/33583 https://discourse.nixos.org/t/nixcon-2023-sponsorship-situat... TL/DR: they accepted sponsorship by Anduril, a weapons manufacturer and publicized that fact 3 days before the conference. The German scene is quite pacifistic and threw a fit.
        busterarm 3y ago
        While "threw a fit" is accurate, it really does downplay the level of hostility that was expressed in response to the situation. It was unbecoming of any group that wishes to call itself a community and it certainly has chilled participation from reasonable people.
- dylan604 3y ago
  So what happens when the vuln is accessed from someone not under German legal jurisdiction?
  - exe34 3y ago
    Vee schend zem a sthrungly vorded letter!
- CalRobert 3y ago
  If you needed security you should've used a fax!

coldblues 3y ago

Should have sold the information on a forum like any reasonable person would.

judge2020 3y ago
Sounds like they're a customer of the vendor, so they'd be pwning themselves if they did so.
- rokkitmensch 3y ago
  Employee of the customer of the vendor!
- jeroenhd 3y ago
  The password was hardcoded into the executable you can download from their website. It wasn't unique. The only trace would've been the database software the guy used showing up in the mysql connection logs, but if he used a VPN the trail would probably die there as far as Modern Solution is concerned.
rokkitmensch 3y ago
The laws as structured and enforced will teach people to do this in time.

fkkffdddd 3y ago

Paragraph 202a of the criminal code: https://www.gesetze-im-internet.de/stgb/__202a.html https://www.gesetze-im-internet.de/stgb/__202a.html Roughly: „Gaining access to data that is protected with special methods against unauthorised access, either for personal use or for others“ So apparently, hardcoded passwords baked into the client do qualify for that.

sgift 3y ago
Yeah. It's well known as a really shitty law, which should never have been passed. But here we are. Maybe until 2050 they fix it or so.
- aleph_minus_one 3y ago
  § 202c is even worse: > https://www.gesetze-im-internet.de/stgb/__202c.html https://www.gesetze-im-internet.de/stgb/__202c.html English translation based on the DeepL translation: "§ 202c Preparing the spying and interception of data (1) Any person who prepares an offense under § 202a or § 202b by 1. passwords or other security codes that enable access to data (§ 202a (2)), or 2. Computer programs whose purpose is the commission of such an offense, or by procuring, selling, transferring, distributing or otherwise making available to himself or another person, shall be liable to a custodial sentence not exceeding two years or to a monetary penalty. (2) § 149 (2) and (3) shall apply accordingly."
- TillE 3y ago
  The silver lining is that the punishment for crimes in Germany is generally extremely lenient. The article mentions a 3000 Euro fine plus legal fees.

j-bos 3y ago

Isn't this the opposite of good samaritan laws? If you see something, say, nothing, do nothing. I wonder, if it's illegal to find these problems, would it be legal to notice there might be a problem, stop, and short the company stock?

IshKebab 3y ago
> would it be legal to notice there might be a problem, stop, and short the company stock? Yes. As long as you don't use inside information this would be perfectly legal. It's pretty much what companies like Hindenburg Research do. The problem you would find if you actually tried to do this is that investors pretty much don't care about security issues, so the stock price wouldn't go down after you revealed the flaw. That's even if they're publicly traded which doesn't appear to be the case here. I think it's these guys but I don't speak German so don't quote me: https://www.modernsolution.net/ https://www.modernsolution.net/
hipadev23 3y ago
Issue is those flaws can go unnoticed for years, so you may need to give them a nudge for your short to be successful. There’s also the fact that at least for US companies massive data leaks/breaches often have no negative financial impact on the company.
ajsnigrutin 3y ago
Tor + twitter (if you can actually register there with tor): "Hey, I just happened to find out that there is a password here in this app, at offset X, here's the screenshot from the hexdump with the visible password... I'm not allowed to check what that password is, even though there is also a username and a host next to it, and clear indication that it's an sql connection, but i'm not testing this, but i'm warning you, the general public, that this here exist, please don't try connecting to this IP using this username and password, thank you!"

mywittyname 3y ago

We, as an industry, need to create an institution that lobbies for fair laws on the handling of computer crimes as well as creates public awareness campaigns that help people better understand cyber crimes. I'd like to see "Good Samaritan" laws for cyber crime. This kind of thing is what enables cyber crime. I personally find lots of bugs with APIs, since my job involves dealing with so many of them. I basically don't report them for fear of prosecution. There's already a fear in the back of my mind when I'm trying to work around such bugs that someone will come after me, but at least I have some plausible deniability to say, "I just wrote shitty software." Whereas, if I report a bug, that means I knew about it and admit to "probing" it to elicit more information. I literally spent 4 hours this morning working around a vendor API bug.

costco 3y ago
That's what the EFF does.
- soraminazuki 3y ago
  Would that help the German developer though?
- yieldcrv 3y ago
  I don’t get how the tech sector as a whole is so inept at this after half a century now. EFF plays defense, when it should be playing offense more effectively Organizations like it need to be donating to campaigns Play the game until the lobbying laws change All of our people should have been pardoned because the President was in our pockets. Aaron Schwartz would have had nothing to worry about, maybe that gets someone attention here
deleted 3y ago
[deleted]

_l219 3y ago

After moving to the UK, it has been my policy to pretend to see nothing. During my first week in university, I found a vulnerability in two of their servers allowing me to execute arbitrary code/commands + escalate to root due to a very outdated kernel. I reported this to a lecturer and was immediately told that what I did was illegal and not to poke at any of their services. Last I checked, it still hasn’t been fixed.

jonnycomputer 3y ago
The ostrich approach to tech security.
- ngneer 3y ago
  If it ain't broke don't fix it ;)
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
spacecadet 3y ago
Yes it is illegal, wont stop someone. Fools.
tommiegannert 3y ago
> I reported this to a lecturer I wonder if such reports would be taken more or less serious if it was made anonymously.

wackget 3y ago

Article/title is a bit confusing and perhaps borderline clickbait, so... If I understand correctly it seems like his crime was *using* the exposed database credentials to log in to the third-party database server. So he wasn't charged for simply "exposing" the credentials as the title says, but actually using them to poke around.

bluefirebrand 3y ago
It is basically impossible to know what a system is without accessing it and looking around. It is like being given a key card for security clearance in a building. You assume any door it opens is a room you're allowed to be in. If security finds you in a room you aren't supposed to be in, is that your fault? Or whoever gave you the card with the wrong clearance level? Also how about the situation where you open a door, look inside, immediately realize you're not supposed to be there and then report it to security? Should you be punished?
- secondcoming 3y ago
  I don't see why an investigation into excessive logging requires running queries on a database.
  - lcnPylGDnU4H9OF 3y ago
    If they connect with a desktop application, said application might run some queries against `INFORMATION_SCHEMA` in order to display schemas, tables, and columns. If the investigation is open-ended enough ("we have no idea so just figure it out"), then it might seem reasonable to connect to the database to see what it's about. It's already hard to see the malice in their actions but it's harder still when I consider that they immediately alerted the company who made the error. Even more when I consider that the company fixed the error. This developer did the company a favor and they had charges filed against them over it.
    - formerly_proven 3y ago

mdgrech23 3y ago

So many "hacks" are the equivalent of some fool left the front door wide open. If you left your front door wide and were robbed the public would have 0 sympathy for you yet people scream at the Hackers when these companies cheap out and don't do shit to update/maintain/enforce basic best practices around security.

babarock 3y ago
It's not about "sympathy". It's about crime. If you left your front door wide and I robbed you, I'd have committed a crime. There's no "but the front door was open" defense.
- wvenable 3y ago
  But nobody was robbed. This guy looked in the house and then immediately called you to tell your door is open. Instead of thanking him, you sue him for trespassing. Technically, he would be guilty of trespassing.
  - hooverd 3y ago
    Private residentce is a bad analogy. This is like being sued for trespassing because you stepped over a green-grey marble line on the grey-green marble floor of the open ground floor lobby of an office building where you work.
- AndroTux 3y ago
  It’s like telling someone the pin to your safe and then suing them for them opening it. They didn’t even steal anything. They just opened the safe that you gave them the pin for.
bdcravens 3y ago
> If you left your front door wide and were robbed It would still be a crime. I would and should be chastised, but the person who robbed me should still receive a proper punishment.

happytoexplain 3y ago

I struggle with the use of the word "hacking". Sometimes we want it to mean a penetration that requires exceptional knowledge and effort. Sometimes we just want it to mean "fiddled with the internals". I once did a search in the free version of Feedly. They showed me the real search results, behind a "this is a paid feature" overlay. I submitted feedback saying they should either provide the feature or not provide it - and refrain from this in-between teasing. I mentioned that I deleted the overlay in the HTML to see the results, and they told me I had "hacked" the web app in their response. That usage, and this usage, are ridiculous, because they imply an unscrupulousness that isn't present. And yet applying the friendlier meaning of the word, as in "Hacker News", I think is reasonable in both cases.

aleph_minus_one 3y ago
> I struggle with the use of the word "hacking". Sometimes we want it to mean a penetration that requires exceptional knowledge and effort. Sometimes we just want it to mean "fiddled with the internals". "Hacking" means "getting (typically) technology to do things that they were not intended to do, sometimes in a playful way". The other meaning was purposefully disseminated by the mainstream media to spread fear and hate against the hacker scene, because their knowledge about programming, computers and technology was a thorn in the side of specific groups in power.
- fluoridation 3y ago
  Okay, but that clearly cannot be the meaning being used here, since to prohibit "hacking" in this sense is not unlike a blanket prohibition on "play".
  - aleph_minus_one 3y ago
    Did you read the original link: https://infosec.exchange/@WPalant/111776937550399546 https://infosec.exchange/@WPalant/111776937550399546 "Current news: A court found a developer guilty of “hacking.” His crime: he was tasked with looking into a software that produced way too many log messages." Note that “hacking.” is in quotes, which should clear the opinion that the poster "Yellow Flag" considers it to be ironic that this action is called "hacking".

yieldcrv 3y ago

so he would have been fine if he didn't check the vendor database? or if he got written authorization to check the database?

HL33tibCe7 3y ago

No, he was found guilty for using those credentials to connect to the database. I can’t speak for German law, but at least in the UK this would be an open-and-shut case, it’s a clear violation of the Computer Misuse Act. You can like that or not, but if you’re in the position to be doing research like this, you really ought to know the basics of the law.

a_dabbler 3y ago
Sounds to me like the database credentials were embedded in the application so presumably the application would log in to the vendors server as an intended action. Does this mean all the vendors users must be charged with hacking also?
- HL33tibCe7 3y ago
  The clue’s in the name: “misuse”.
  - dzhiurgis 3y ago
    Is there evidence he misused the data or the server? Did he download all the data and sold to third parties, spammed the hell out of existing users or anything like that? How is verifying the credentials misuse?
    - HL33tibCe7 3y ago
      He didn’t just “verify the credentials”. He was in the database making queries, viewing private data.
      - feanaro 3y ago
        "Viewing" private data for purposes of verification of the issue. How about you just don't ship passwords in the application like some negligent troglodyte?
      - 3y ago

vdaea 3y ago

After reading the text I predict this is completely sensationalised and that something worse happened.

z500 3y ago
According to the linked heise.de article the defendant assumed the credentials were for a database that only contained his client's data, and immediately disconnected as soon as he realized he was actually seeing data for all of the complainant's clients.
pgeorgi 3y ago
It's a lowest level court, they're known to have wildly absurd legal opinions at times. Having stupid laws on the book (like the one in question) doesn't help. The curious bit is that this law is from 2007, so apparently this is an angle that escaped all attorney and courts who applied this law in 16.5 years, or the defense could have shot down this line of reasoning by pointing out that this isn't what the law intended. (we don't have case law, but there are means of harmonizing outcomes once stuff ended up at higher level courts) My guess is that this won't hold up for long given the circumstances (trivially got the password, accidentally gained more access than expected, immediately disconnected upon notice)
- cybrox 3y ago
  I've been following this for a long while now, as I frequent one of the forums that this person is also active on. Even if the sentence is overturned by a higher instance, the confiscation of all devices for months and the additional legal trouble have made pretty sure that this person will not make the same "mistake" again. The company's public statements during the whole affair were another story entirely. For these alone they'd deserve the next guy to just sell the credentials on a forum and have them blow up.

magicmicah85 3y ago

It's a very fine area. Once he had the database credentials, that's all he needed to tell the company to fix their code. Connecting to the database is what did him in. We need white hats that want to find vulnerabilities for good, but when you exploit a target and they aren't aware until after the fact, that's still a crime. I don't know what the safe way of doing this is other than only doing white hat hacking on systems you control. Any system outside of your control should not be exploited unless the company has an agreed upon contract that indemnifies you from any harm caused.

fluoridation 3y ago
Alternatively, reporting the vulnerability is what did him in. This seems to encourage an adversarial environment where no one will report any vulnerabilities they find for fear of repercussions. If their good faith efforts will be used against them, they may as well act in bad faith.
raphman 3y ago
The developer claims that he assumed that he assumed that the database credentials were specific to the customer he was helping debug the problem. Once he realized that he could see other data, he closed the connection and notified the company. I'd argue that a customer who accesses their own data on a vendor's database via a client has also the right to access it via a different client.

throwitaway1123 3y ago

Something similar happened in Missouri a few years ago when the state's web developers leaked thousands of social security numbers in the HTML of one of their websites. A reporter noticed the flaw, reported it to the state government, waited for them to fix it, and then finally publicized the security issue. The governor (Mike Parson) accused the reporter of "hacking" because he clicked the view source button in his browser.

deleted 3y ago
[deleted]

yukkuri 3y ago

Better to just pretend you never noticed it. Even telling them their password is visible is risking being the messager that gets shot. Using the password is right out.

daltont 3y ago

Sounds similar to a case where I am from: https://www.techdirt.com/2022/02/25/turns-out-it-was-actually-missouri-governors-office-who-was-responsible-security-vulnerability-exposing-teacher-data/ https://www.techdirt.com/2022/02/25/turns-out-it-was-actuall... The "hacking" was decrypting social security numbers from BASE64.

throwitaway1123 3y ago
Yeah, this is exactly the case that the headline reminded me of (I got instantly downvoted for commenting about this for some reason). If they had actually encrypted the data it would have been fine, but BASE64 encoding is not encryption. It's trivially easy to decode base64: https://developer.mozilla.org/en-US/docs/Glossary/Base64#the_unicode_problem https://developer.mozilla.org/en-US/docs/Glossary/Base64#the...
RajT88 3y ago
Funny message in the encoded Base64 on that article, which reminds me of a musing I had a while back. Imagine the number of lazy programmers who paste stuff into an online Base64 decoder. Imagine all the stuff that is in those payloads! Running a site like base64decode.org would be a fantastic honeypot.
- j-bos 3y ago
  That's why many large firms block online code assist tools.

formerly_proven 3y ago

This case has been going on for a few years. Last summer the court declined the prosecutor's case (in this system, the prosecutor files their case with the court, and the court does a quick scan and will dismiss the case before scheduling the trial if it's obviously unsound - happens fairly rarely). Prosecutors got this overturned by a higher court, which means this trial happened at the same lower court, but with a different judge than the one who initially dismissed the case. > According to a decision by the Jülich District Court on May 10, 2023, the criminal proceedings against the security researcher have been dismissed. The court assumes that no criminal offense has been committed because the data accessed by the security researcher was not sufficiently protected. "Only data that is specially protected against unauthorized access is subject to the scope of protection of the criminal offence. This presupposes that measures have been taken that are objectively suitable [...] to prevent access to the data," the court's decision states. "The court does not agree with the opinion of the public prosecutor's office that password protection as such is sufficient. A password does not always provide effective data protection, for example if it is too simple or is used in a standardized way for certain applications. In such cases, the provision of access to data does not constitute an offense." > Through its own investigations of the Modern Solution software, heise online was able to confirm that it did indeed contain a built-in default password. This meant that anyone who had examined the software, which was freely downloadable from the company's website, would have had access to the data on the Modern Solution servers.

Alifatisk 3y ago

Can we flag posts for clickbait headline?

orenlindsey 3y ago

This is like giving someone a book you wrote to proofread, with your password unintentionally in the text. They use it to login and then tell you about it. Sure, they shouldn't have logged in, but it doesn't feel like it deserves criminal charges.

PurpleRamen 3y ago
Just because you can, doesn't mean you should... And it's not a criminal charge, the penalty is paying 3000 Euro and the costs of the lawsuit.

hypeatei 3y ago

Seems like those laws to need to be re-written. Intent matters and it doesn't seem like this "hacker" was trying to do any harm. Company got caught with their pants down and want to punish this person for exposing that.

quickthrower2 3y ago
Yeah it is a chilling effect that will make German systems less secure, and other countries who are immune from German prosecution are going to exploit that. This story alone makes me refuse to work in Germany as a developer let alone in security.
- WesolyKubeczek 3y ago
  Hackers somewhere in Novosibirsk who look for ways to disrupt or exfiltrate data from some of the Germany's bigger IT systems, are likely very gleeful now. Look ma, they just leave their passwords in cleartext, and people are scared shitless to report it, lest they be sued! It's a pure gold mine!
EasyMark 3y ago
I agree, this conviction is really about challenging corporatism and making them look bad. They really want "the peasants" to know their place and not peep through the nobles' windows. The state will almost always side with those with the most money, unless lawyers somehow shine the light of public opinion on it, then they might have a chance. This is why you do stuff anonymously.

ttyyzz 3y ago

Greetings from Germany, I would not be surprised in the slightest if German legislation considered pressing F12 in your browser looking at the HTML was considered "hacking".

deleted 3y ago
[deleted]
pavel_lishin 3y ago
Where do you think Germany is, in Missouri? https://www.theverge.com/2021/12/31/22861188/missouri-governor-mike-parson-hack-website-source-code https://www.theverge.com/2021/12/31/22861188/missouri-govern...

niemandhier 3y ago

If you ever wonder why Germany is trapped in a predigital state since the late 2000s: Things like this are the reason. If met people from all over the word, some of the coolest hackers and devs were from Germany, but: The perpetual effort of the German government to make all things „safe „ and „stable“ hinders the evolution of the country into something greater than a nation of car manufacturers.

aleph_minus_one 3y ago
> If you ever wonder why Germany is trapped in a predigital state since the late 2000s I think the term "(pre)digital" does not fit: for example CDs and punchcards are clearly digital.
deleted 3y ago
[deleted]
pmarreck 3y ago
Here's a good article on the problem. Seriously, given how excellent most other qualities of life are in Germany, and how smart/educated Germans are, the Internet situation is jarringly bad (for anyone who visits or emigrates, and isn't used to it). I think there's even a bit of pride about it, I hate to say. Germans are pretty proud of their outdoor activities and general physical health, and "device obsession" works directly against that... and is still not as much of a thing there as in the US for example. You could make an argument for it... https://www.settle-in-berlin.com/why-is-internet-so-bad-in-germany/ https://www.settle-in-berlin.com/why-is-internet-so-bad-in-g... tl;dr Blame Helmut Kohl. Helmut was clearly the type of guy who would have printed out his emails (if he even had to email, if perhaps only by necessity) until the day he died.
- aleph_minus_one 3y ago
  > Here's a good article on the problem. Seriously, given how excellent most other qualities of life are in Germany, and how smart/educated Germans are, the Internet situation is jarringly bad (for anyone who visits or emigrates, and isn't used to it). > I think there's even a bit of pride about it, I hate to say. Germans are pretty proud of their outdoor activities and general physical health, and "device obsession" works directly against that... and is still not as much of a thing there as in the US for example. You could make an argument for it... Honestly, I am not sure what kind of "device obsession" in other countries vs Germany you are talking about. My impression, as a German, is that many German people value other qualities of technological products than what is valued in other countries. For example, many German customers value long-lasting, robust products instead of the latest fad that will be out of fashion in a few years. For example, many Germans who are able to afford them would love household appliances built by Miele. Also, because of the German history (two dicatorships on German soil of which one ended little more than 30 years ago), many Germans are much more suspicious of "spying devices" (e.g. internet-enabled home appliances (IoT)) and things that might track you (this is also a reason why many Germans strongly prefer paying cash). But it is nevertheless my impression that many Germans nevertheless do have quite some love for devices that do fit their values; it's just that the taste is quite different from the taste in other countries.

wouldbecouldbe 3y ago

Had a food startup in the Netherlands. Worked with PostNL, the main and previous governmental organisation for sending mail. Weekly we would upload our orders in their system; and could see our history. Then one day we could suddenly access all other clients history and export their users data. Many of them direct competitors, and their mailing lists would have been quite valuable to us. My partner exported all Marley Spoon's (a bigger funded competitor) data in excel and a few others. When he told me I told him to delete it ASAP, even though it's fun you don't create a liability. But we could have used it to grow 10-30% in a few weeks. They never reported it, which they were legally obliged to do under EU law. All to say, if you get the keys to the castle, maybe don't use them. Or maybe you do. We should, and could have used it, in price negotiations since they almost doubled the prices to us for the next few months and didn't have any mercy. Let alone misplacing 3-8% of our orders and not refunding. But instead we moved to few other delivery services (with all their own flaws)

jeroenhd 3y ago
You can anonymously tip the Autoriteit Persoonsgegevens and let them look into the issue if you're afraid of repercussions. Any screenshot containing evidence of PII being leaked will certainly help, and I doubt PostNL will have fixed their terrible terrible systems. Under Dutch law your colleague would've committed a crime by downloading the data he knew he shouldn't be allowed to access, beyond what was necessary to conclude that there was a leak. "Using" this indo during negotiations would've been blackmail, which is very much a thing you wouldn't want to do, especially with a company that big and without real competition; they'd go to the police, and you'd be screwed.
- wouldbecouldbe 3y ago
  You can subtly mention things to alter the dynamics of a conversation without it being blackmail ;). Or forcefully making demands and wanting proof that our data is safe. To report it now, it's so many years back by now, not worth the trouble and proof is gone. But they were so disrespectful to us regarding not wanting to refund a lot of lost orders while at the same time doubling prices, that I almost reported them out of spite.

gumballindie 3y ago

> So he immediately informed the vendor – and while they fixed this vulnerability they also pressed charges. Germany has an obsession with accusing people of crimes. Perhaps a projection?

cybrox 3y ago
Ah yes, the homogeneous entity of germany born in 1939... To the bottom you go.
- gumballindie 3y ago
  I am confused by your comment.

petre 3y ago

Ah Germany, where everything is precisely regulated, even the use of kitchen knives, which are of course unlawful to use outside of the kitchen. Nur in der Küchen schneiden mit dem Küchenmesser!

hnbad 3y ago
I'm not sure what you're talking about. If you carry around a kitchen knife in public for no good reason, it's not a kitchen knife, it's a weapon. Likewise if you carry around a baseball bat and didn't just buy it or are on your way to a baseball game or to gift it to someone, that's a weapon too. Carrying weapons in public without a permit is illegal. If you're merely transporting the kitchen knife to a party to help your friend prepare snacks, that's clearly not a weapon even though you're in public and carrying a knife. I've done medieval reenactment in Germany and used public transit in full kit with spears and swords and everything. I've been stopped by police a few times to check that they are indeed dull and blunt and therefore can legitimately be considered sporting or theatrical equipment but that shouldn't be surprising as it effectively looked like I was "open carrying" medieval weaponry for unknown reasons. Heck, the only times I was stopped were around the time someone robbed a gas station with a sharpened katana so I can't even fault them for being careful.
- petre 3y ago
  Robbing a gas station with a sharpened katana makes me yawn. The US ha solved this with shotguns. In Europe I'd totally use the fire extingusher. Actually I'm quite fond of Germany as boring as it is.

Zamicol 3y ago

The law shouldn't be involved in this. Fix your systems. Tax payers should not be forced to defend poorly designed systems.

aleph_minus_one 3y ago
> The law shouldn't be involved in this. There were huge public rallys when the § 202c StGB (https://news.ycombinator.com/item?id=39047767 https://news.ycombinator.com/item?id=39047767) was to become introduced. In Germany, we learnt that resistance and rallys against the politics is typically futile. Thus, in the recent years in some circles in Germany it has become actually fashionable to speak "Politiker" (politician) in a tone as if you were speaking of a mass rapist or child abuser (and covertly do this word replacement in your head). Believe me: in some circles in Germany, the fury against the politicians of basically every party is insane. :-(

WesolyKubeczek 3y ago

Next time: never report anything. Sell it on some black market, then forget everything about it. Alternatively, get a sockpuppet account, publicize the information anonymously somewhere, then pretend you accidentally stumbled upon it and sue the vendor for gross negligence with your data. Go on the offence. Germany is so anal on privacy laws that I suspect the whole case has been hinging on the company making the first move. Keep sucking those sweet damages. I'm surprised there's not a whole fucking industry around this behavior, which is way too common to go unpunished. Don't be a boy scout. This seems to be frowned upon these days.

posterboy 3y ago

Title could be read as exposing by means of an app dedicated to exposing said credentials. Hackernews suggests something else, but hasn't really outlined the expose-action. The text of the decision should be paramount.

woopwoop24 3y ago

meh, low level court decision, this will not stand in the higher court.

jansommer 3y ago

I think a lot of issues are never reported because of stuff like this. We hear about white hat hackers getting sued all the time. And in the end it'll hurt us all because crooks don't care, and will use these found-but-undisclosed security holes to their advantage. Then, when they threaten the company to either pay or get a public dump of their wide-open database, management refuses and gets a slap on their wrist by the government once it's released - and customers receive a "sorry, we got hacked"-mail between a bunch of highly personalized phishing mails.

BonoboIO 3y ago

What a sad case and i think nobody should do business with this corporation ever again. Next time: use a vpn, get yourself a anonymous email address and report it to your goverment dataprivacy office. Make it hurt. Make it hurt bad.

sva_ 3y ago

Ah, the infamous "hackertoolparagraf". The hacking tool in question? According to [0] it was phpMyAdmin. 0. https://nitter.net/der_sofc/status/1747644600469127386 https://nitter.net/der_sofc/status/1747644600469127386 edit: Apparently der_sofc is the person who got sued.

riedel 3y ago

The German article link gives a few nuances more: first the ruling is not yet binding and has chances of going into revision. Secondly the fine seems partially due to a public disclosure to press while offering competing services.

evilDagmar 3y ago
Frankly I think they should just take their lumps and shut up. Other bits of the article mention that apparently Heise Online was able to freely download a copy of the binaries (passwords included!) from Modern Solution's website in 2021 and I'm going to guess based on that that other people probably did know about this who were reasonably moral about it, and the company was likely ignoring the issue... ...until someone offering competing services noticed it and said something, at which point they panicked and decided it was still cheaper to shoot the messenger than to hire a couple of highly-caffienated teenagers to fix their trash architecture.

scrps 3y ago

Good marketing pitch for disclosing to the highest bidder rather than responsibly to industry, gonna go to jail you might as well get top dollar for your trouble. Oh no we did a terrible job and hardcoded credentials, someone found and tried a password and then reported it without stealing or destroying anything but our egos... the horror. Let's run to the cops and potentially ruin a life.

dudalev 3y ago

Isn’t it the vendor that should be immediately countersued by the customer for the lack of any actual protection?

jpgvm 3y ago

No good deed goes unpunished.

bsdice 3y ago

This is actually a big problem for Germany, because the cited StGB 202 ff. penal code paragraphs have made security research in any private sector shape or form impossible, or at least highly unattractive. Now a gap of almost 20 years has opened, where basically no young engineers have been interested in the field, let alone trained. The biggest companies with the deepest pockets have been mopping up anyone they could find. Top talent went abroad. And so the majority of German businesses which are SMB get hacked more every day. Nobody audits anything. Unfortunately, anything networked is a security risk these days. I caution that it is highly naive to bet on this getting thrown out at higher court levels. Defendant is looking at YEARS of wasted brain cycles, trying to go from AG to LG to OLG to BGH. My guess is a 100k EUR of fees also wasted. And for what. Because a company couldn't properly secure their data, you told them that, and as a "thank you", they sued you in court? My advice: If there is no clear bug bounty program, or it is not your own company, or you weren't tasked in writing and paid by the very company to find any holes, don't make it your problem. Suppress any good samaritan helper complex you might have. Wipe all files and talk to nobody. Especially not in your place of employment. Once a lawsuit is involved, anyone questioned will say "Oh, Mike from DevOps figured that one out from the hexdump". You will regret it. Some of the older German infosec dogs are aggravated by this so much, that they refuse to help any governmental organization if there is an incident. Lernen durch Schmerz.

rurban 3y ago

For more context: His crime was to be a business competitor of this shady company Modern Solution, which shipped the password of all its customers. He was not an independent security researcher.

evilDagmar 3y ago

Sadly this is why one must notify vendors anonymously, and tell them up front they have 30/60/90 days to fix it before the information will be made public. This vendor was abysmally irresponsible by storing static credentials in the application with apparently full read access to the databases. Stored procedures exist for a reason and they're not even remotely new. If a "bad guy" had dug this out first, things would have been much, much worse for everyone involved, including the vendor. Trying to shoot the messenger makes me wish they'd mentioned which vendor so that their customers could be encouraged to go with someone who takes security even a little bit seriously.

dorameleg 3y ago

I don't understand how this news started spreading so much now. This actually hpapened in 2021. Everybody mentions the original source, Heise, but nobody checked it. Their article was published in 2021. https://www.heise.de/news/Datenleck-Anzeige-gegen-IT-Experte-kam-von-Modern-Solution-6254839.html https://www.heise.de/news/Datenleck-Anzeige-gegen-IT-Experte...